Radio-Frequency Identification (RFID): a Focus on Information Security and Privacy”, OECD Digital Economy Papers, No

Please cite this paper as:

OECD (2008-01-14), “Radio-Frequency Identification (RFID): A Focus on Information Security and Privacy”, OECD Digital Economy Papers, No. 138, OECD Publishing, Paris. http://dx.doi.org/10.1787/230618820755

OECD Digital Economy Papers No. 138

Radio-Frequency Identification (RFID)

A FOCUS ON INFORMATION SECURITY AND PRIVACY

OECD

Unclassified DSTI/ICCP/REG(2007)9/FINAL

Organisation de Coopération et de Développement Economiques Organisation for Economic Co-operation and Development 14-Jan-2008 ______English - Or. English DIRECTORATE FOR SCIENCE, TECHNOLOGY AND INDUSTRY COMMITTEE FOR INFORMATION, COMPUTER AND COMMUNICATIONS POLICY Unclassified DSTI/ICCP/REG(2007)9/FINAL

Working Party on Information Security and Privacy

RADIO FREQUENCY IDENTIFICATION (RFID): A FOCUS ON INFORMATION SECURITY AND PRIVACY

www.oecd.org/sti/security-privacy

English - Or. English

JT03238682

Document complet disponible sur OLIS dans son format d'origine Complete document available on OLIS in its original format

DSTI/ICCP/REG(2007)9/FINAL

FOREWORD

This report was prepared by the Secretariat with the assistance of Nick Mansfield, consultant to the OECD. The first draft benefitted from initial input from Francis Aldhouse, consultant to the OECD. It includes comments and suggestions from OECD member countries, business and civil society.

The report was discussed by the Working Party on Information Security and Privacy in October 2007 and declassified by the Committee for Information, Computer and Communications Policy on 17 December 2007. It is published under the responsibility of the Secretary-General of the OECD.

2 DSTI/ICCP/REG(2007)9/FINAL

TABLE OF CONTENTS

EXECUTIVE SUMMARY ...... 4 INTRODUCTION ...... 8 1. UNDERSTANDING RFID ...... 10 1.1. A broad concept for a complex technology ...... 11 1.2. Hardware components ...... 12 1.3. Electromagnetic communication ...... 16 1.4. Software and network components ...... 23 2. INFORMATION SECURITY AND PRIVACY ...... 25 2.1. Information security ...... 25 2.1.1. Typology of risks ...... 26 2.1.2. Security controls ...... 33 2.1.3. A holistic approach ...... 35 2.1.4. Adjusting security level to what is at stake ...... 36 2.2. Privacy ...... 37 2.2.1 Overview of privacy challenges ...... 38 2.2.2 Possible safeguards ...... 41 CONCLUSION ...... 50 ANNEX I. EXAMPLES OF RFID STANDARDS ...... 52 ANNEX II. NFC, UWB, ZIGBEE, RUBEE, WI-FI, ULTRASONIC TECHNOLOGIES ...... 54 ANNEX III. SECURITY EXPLOITS ...... 57 ANNEX IV. THE ELECTRONIC PRODUCT CODE (EPC) NUMBER STRUCTURE ...... 59 ANNEX V. EXAMPLES OF PRIVACY REFERENCES ...... 60 BIBLIOGRAPHY ...... 63

3 DSTI/ICCP/REG(2007)9/FINAL

RADIO FREQUENCY IDENTIFICATION (RFID): A FOCUS ON INFORMATION SECURITY AND PRIVACY

EXECUTIVE SUMMARY

The deployment of Radio Frequency Identification (RFID) in a large number of application areas is promising. This paper introduces the main characteristics of RFID technologies and focuses on the information security and privacy aspects of RFID in the short term. It will be complemented by an overview of RFID applications and an analysis of economic aspects of RFID carried out by the OECD Working Party on the Information Economy (WPIE).1 Later on, and based on both sets of work, a common set of policy principles related to RFID will be developed.2

This report represents the first step of OECD work related to sensor-based environments. Follow-up work will address security and privacy issues raised by a number of possible longer-term trends such as the generalisation of object tagging (pervasive RFID), of open loop RFID and of other sensors and sensor networks that can monitor the environment.

A varied and complex technology

RFID is a convenient and popular term for a technology with vague boundaries and many facets. Radio-frequency identification is not always based on radio-frequency communications and identification is only one among the many functions RFID technology can perform. Rather, RFID enables data collection with contactless electronic tags and wireless transmitters (readers) for identification and other purposes. It can be seen as a first step towards sensor-based environments.

Understanding the capabilities and limitations of RFID technology is essential because the likelihood of several potential security and privacy risks varies according to the type of RFID technology used as much as according to the context in which RFID is implemented. The paper therefore provides basic information on RFID technology, including elements regarding standards, hardware and software components, frequency ranges, modes of operation (electromagnetic induction or radio-waves) and operation ranges.

Information security aspects

There are a large number of potential risks to RFID tags, readers and tag-reader communication that implicate each of the three classical dimensions of security: availability, integrity and confidentiality. Examples include denial of service, jamming, cloning, eavesdropping and skimming. Malware using tags as a vector for dissemination has also been identified as a potential risk. Tags and readers are not the only components of RFID systems that require security protection. Software (middleware), network and database components are also subject to information security risks. RFID security risks are not theoretical: a number of vulnerable security products and systems, sometimes deployed at very large scale, have been

1 . See OECD (2007b, c). 2 . DSTI/ICCP/IE/REG(2007)1.

4 DSTI/ICCP/REG(2007)9/FINAL discovered by researchers or reported in the press. However, many of these potential risks are more or less likely to occur depending on the type of RFID technology used (e.g. eavesdropping is less likely when magnetic induction is used because the operation range is very short).

Ensuring RFID security requires a mix of technical and non-technical controls to prevent and mitigate risk. A number of technical controls are available. However, their degree of sophistication, robustness, complexity and cost varies. As a result, there is no one-size-fits-all RFID security measure that would efficiently address a given class of risks in all possible situations and at low cost. The development of well tailored and innovative technical security safeguards for RFID may therefore be a critical success factor for large scale deployment of RFID in many areas.

As mentioned above, not only do risks to RFID systems vary considerably according to the technology used, they also vary depending on the application contexts and scenarios. Consistent with the OECD Security Guidelines, risk assessment and risk management can help address the security of RFID systems. A holistic approach to risk (e.g. carefully considering each stage of the system’s life – planning, deployment, operation, data processing and end of life – and each component of the system – tags and readers, middleware, databases, back-end and network components) is required to develop an overall security strategy. The risk evaluation and management strategy help identify the necessity to strengthen specific parts of the system in order to compensate for some weaknesses that cannot be addressed directly.

Like any technology, adjusting RFID security to the appropriate level requires striking the right balance between the value of the assets to protect, the possible damages an attack could generate, and the risks. Key factors to consider include the potential impact on privacy when information related to individuals is used. Strategies to enhance the level of security include investing in more secure RFID, associating RFID with non-RFID security controls or using other technologies than RFID.

As RFID technology is still young and evolving, innovative and unpredicted cracking techniques are likely to emerge. Review and reassessment of RFID systems is key for deciding where security investments should be made to deal with evolving risks.

Privacy aspects

Potential risks to privacy are generally important concerns for individuals and organisations. Key characteristics and functionalities of RFID technologies have the potential to offer benefits (e.g. convenience, expediting processes) as well as to foster misperceptions and to impact privacy. RFID systems that collect data related to identified or identifiable individuals raise specific privacy issues that should be considered as a priority challenge to the adoption of the technology in a large number of areas. In most cases, the potential invasion of privacy through the use of RFID depends on both the technology used and the context.

Invisibility of the data collection may be the primary characteristic of RFID that raises concerns. It is also a risk multiplier for the potential privacy challenges associated with the use of the technology. RFID might reveal to third parties information about objects carried by individuals without their knowledge. It might allow inferences enabling links to more information on the individual and more precise profiling: for example inferences made from multiple tags carried by an individual or from sensitive data, such as biometrics in an unsecure RFID passport, or from tagged medicines. Such a scenario would require the presence of readers in the tags’ environment as well as the capacity for the third party to convert the objects’ tag information into meaningful data.

Likewise, tracking in real time or after the fact may be the primary functionality of RFID that raises concerns. In particular, because of the invisibility of the technology, tracking of individuals could happen

5 DSTI/ICCP/REG(2007)9/FINAL without their knowledge, if they are provided with hidden tags or tags that are not sufficiently secured. In other cases, tracking people could also be the objective of the RFID application (e.g. tracking children in an amusement park).

Another concern is that interoperable (“open loop”) RFID technologies facilitate and therefore multiply the collection and processing of personal information. Pervasive RFID taking advantage of interoperability and ubiquitous Internet connectivity is often described as an inevitable future, though there are currently few examples of open loop systems.

In cases where RFID systems collect data which is associated with an identified or identifiable individual, the OECD Privacy Guidelines provide a useful framework.

When an RFID system processes personal data, transparency of the purpose of the processing and consent of individuals are essential. Beyond basic data protection information, privacy notices may usefully include further information such as i) the existence of the tags, ii) their content, use and control, iii) the presence of readers; iv) the reading activity, v) the ability to disable tags and vi) where to obtain assistance. Innovative means of informing individuals efficiently could be explored. Continued stakeholder dialogue between stakeholders, across sectors and in each of the specific application areas, would help clarify or reach a consensus on what information to provide to individuals, the best means to communicate it to achieve efficient transparency, as well as the cases where consent should be or not be required.

Naturally, security safeguards are essential for the protection of privacy in RFID systems.

The wide variety of technical configurations and use scenarios make privacy impact assessments a good practice for identifying and understanding privacy risks and best strategies to mitigate them in a given system. As for security, because RFID systems are often components of broader information systems, it cannot be expected that all privacy challenges can be solved at the RFID level. A holistic approach to privacy management may be highlighted as a good practice. Such an approach would consider all the components of the information systems involved, besides the core RFID components as well as the whole life cycle of the tag when it remains functional beyond the reach of the data controller.

The choice of the RFID technology to be used in a system influences the protection of privacy just as it impacts the security of the system. Privacy by design or embedding privacy in the design of the technology and of the systems can significantly facilitate the protection of privacy and foster trust in RFID systems. Efforts to develop RFID privacy enhancing technologies are ongoing and could be encouraged. Techniques such as data minimisation and anonymisation can be applied to RFID. Strategies to provide incentives to industry and business for designing and using RFID technologies that include sufficient privacy protections could be pursued. Nevertheless, as for security, privacy protection should not solely rely on technical measures but rather on a mix of technical and non-technical safeguards.

Some parties do not associate tag data with individuals yet provide them with consumer goods tagged with functional RFID tags that they or third parties could later read. It could be suggested that such parties take responsibility for either deactivating the tag or providing information to individuals regarding the presence of the tags, the privacy risks associated to them and the means to prevent or mitigate such risks.

Finally, and more generally, RFID is not well understood by individuals. Increasing the level of awareness and understanding about RFID, its possibilities and limitations as well as benefits and risks, can contribute to reducing this perception issue. It may also help individuals make appropriate choices and support efforts by organisations to deploy privacy friendly systems.

6 DSTI/ICCP/REG(2007)9/FINAL

Conclusion

Security and privacy issues in relation to RFID infrastructures and related software should be addressed by all stakeholders before widespread deployment of the technology.

The OECD Security Guidelines provide a framework for developing a culture of security for RFID systems whether they process or not personal data. The OECD Privacy Guidelines also provide a useful framework for guiding the implementation of RFID systems that collect or process personal data.

However, dialogue is still necessary to clarify or to reach a consensus on a number of points, such as i) how to apply the concepts of personal data and data controller, ii) the nature of the information to provide to individuals and the best means to communicate it to achieve efficient transparency and iii) the cases where consent is needed.

Several concepts and approaches reflected in the 2002 Security Guidelines could be adapted to support the implementation of the OECD privacy principles, reinforce their effectiveness and help develop a culture of privacy for RFID systems. They include awareness raising initiatives, risk reduction methodologies (e.g. privacy impact assessments) and initiatives to integrate security and privacy protections in the design of RFID technologies and systems.

7 DSTI/ICCP/REG(2007)9/FINAL

INTRODUCTION

Background

The OECD Information, Computer and Communications Policy (ICCP) Foresight Forum on “Radio Frequency Identification (RFID) Applications and Public Policy Considerations” in October 2005, highlighted the economic potential of RFID technologies as well as new privacy and information security challenges associated with these technologies. It also signalled that RFID could be seen as the first illustration of intelligent networked sensor technologies that would enable the creation of an “Internet of things”. The use of RFID is expected to foster the convergence of communications technologies and ultimately contribute to realising “ubiquitous network societies” through which almost every aspect of an individual’s life and work environments would be linked to an omnipresent, 24/7 global network.

Building on the interest generated in the ICCP Forum, further research on RFID was included in the OECD 2007-2008 programme of work:

• The Working Party on Information Security and Privacy (WPISP) undertook work on RFID and sensor-based computing within the broader context of pervasive sensors and networks with a view to exploring whether OECD Security and Privacy Guidelines would be challenged by these new technology trends, and

• The Working Party on Information Economy (WPIE) undertook work on the economic aspects of RFID.3

In October 2006, the WPISP discussed a preliminary report by the Secretariat exploring information security and privacy issues raised by RFID, sensors and pervasive networks technologies. It recognized that RFID and sensors are at two different stages of development and deployment. Though RFID technologies are evolving and progressing at a fast pace, they have already reached a certain level of maturity and are being deployed at small, medium and large scales in many countries, in several sectors and for various applications. They already raise security and privacy issues. Other sensor and sensor network technologies that monitor environmental parameters and communicate sensed data to other connected devices are less mature and generally deployed on a much smaller scale for applications that rarely affect individuals. Their widespread adoption is still to come, the applications and sectors that will drive that adoption are unknown, and the specific privacy and security issues they could raise are speculative. Specific privacy and security issues raised by pervasive RFID are also yet to come. Therefore, the WPISP agreed that work in 2007 would address issues raised by the use of RFID in the short term. Issues raised by pervasive RFID and other sensor-based technologies in the longer term would be addressed at a later stage.

This report on RFID, Information Security and Privacy underscores the important cross-cutting nature of the security and privacy work of the WPISP. Identity management, authentication and malware all have implications for RFID and other similar technologies. For example, RFID tags can store important personal data and be linked to databases holding personal data. RFID tags are increasingly used to

3. OECD, 2007b and 2007c.

8 DSTI/ICCP/REG(2007)9/FINAL authenticate people and can include biometrics or other authenticating information in large scale identity systems such as passports or national identity cards. Furthermore, RFID tags could well be used as attack vectors for malicious software or “malware”. This illustrates the continued importance of addressing security and privacy issues jointly and in close connection with the evolution of new communications technologies and applications.

Although their creation dates back to the Second World War, RFID technologies have in a few recent years experienced a rapid evolution and broad implementation throughout the economy. As intelligent sensor technologies continue to develop and may, in conjunction with RFIDs, create an “Internet of things”, it is important that the impact of these technologies on the Internet and society be recognised. In this context, the findings of this study will also inform the 2008 OECD Ministerial on “The Future of the Internet Economy”.

Objectives and scope

This paper seeks to clarify the capabilities of RFID in the short term and to identify the information security and privacy challenges raised by this technology, the implications of which may not always be reflected in existing instruments or policies. The OECD Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security (Security Guidelines) and the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (Privacy Guidelines) serve as a reference point throughout the analysis. This paper aims at informing the further development of policy guidance by the WPISP in this area, that will be provided in a separate document, jointly with conclusions of the paper developed by the WPIE on business and government applications of RFID, economic impacts, and government policies to develop and diffuse RFID and related technologies.4

The first section of this paper aims to provide an understanding of RFID which is a broad and somewhat vague concept used to refer to technologies that enable data collection, through use of contactless electronic tags and wireless transmitters (readers), for identification and other purposes. The second section focuses on information security and privacy issues related to RFID that are already present or likely to be raised in a three to four year time-frame as well as on possible solutions to address them.

Although RFID is seen as a subset of sensor-based computing, this paper does not address this broader category that also encompasses other technologies collecting information from the environment without tag devices. Nor does the paper examine issues that may arise when RFID becomes ubiquitous, is used in a manner that is not anticipated today, or in connection with other sensor-based technologies. These issues will be a topic for future work.

4 See DSTI/ICCP/IE(2007)6 and 7 presented at the WPIE meeting in May 2007.

9 DSTI/ICCP/REG(2007)9/FINAL

1. UNDERSTANDING RFID

RFID has been described as the “world’s oldest new technology”. Its invention can be traced back to the 1940s with applications related to the “friend or foe” identification of military aircrafts. The first commercial applications appeared in the 1960s in the area of electronic article surveillance to fight against product theft; an application that is still very much used today. Advances in semiconductor technologies led to significant improvements of the technology. Within the same time-frame, commercial success of the marketed applications generated a dramatic reduction of cost and an ever-increasing interest from businesses.

There are many indications that the proliferation of applications using RFID technology is only at its beginning. Figures provided by market analysts predict a huge market increase over the coming decade. According to a Gartner study (2005), the RFID market’s revenue (hardware and software spending) grew over 33% between 2004 and 2005 (representing USD 504 million in 2005) and will be worth USD 3 billion by 2010. Research firm IDTechEx (2006a) predicts a global market for RFID including systems and services of USD 26.23 billion in 2016 (compared to an estimated USD 2.71 billion for 2006) and a total number of tags delivered of 585 billion, 450 times the amount of 2006. Benefits of RFID technology for business and individuals are very promising (OECD, 2006a).

One important driver for market growth today is that of improving traceability of goods in the supply chain in order to increase supply chain efficiency, reduce theft and fraud, and realise significant cost savings. In addition, many other types of RFID applications have been reported, and the use of RFID technology is now common in areas including passports, hospitals, transportation, ticketing, libraries, museums, counterfeiting, baggage tracking in airports and livestock tagging. With such widespread adoption, it is likely that RFID will affect business and government processes, as well as the lives of individuals and consumers. As stated by the European Article 29 Working Party5 (2005), “the specific functions that RFID tags can deliver in different sectors is also increasing and its possibilities are just beginning to emerge”.

The use of RFID in the global supply chain requires a high degree of reengineering of complex business processes and it is not expected that RFID will become ubiquitous in the short-term at a level that would considerably impact society (e.g. item-level tagging or generalised usage of RFID after the point of sale, etc.). However, it is likely that the number of RFID applications will increase in many different areas, as the aforementioned figures suggest, and that the technology will evolve, enabling new applications.

One of the main findings of the ICCP Foresight Forum on RFID in October 2005 was that privacy and security are key challenges to the widespread adoption of RFID that need to be addressed. Understanding the technology, its capabilities and limitations, helps prevent understating or overestimating these risks.

5 . The Article 29 Working Party is the independent advisory body on data protection and privacy in the European Union. It gathers representatives from European data protection authorities. It was established by the Article 29 of the European Directive 95/46/EC.

10 DSTI/ICCP/REG(2007)9/FINAL

This section provides a general and conceptual overview of the technology, the characteristics of tags, readers and the environment in which RFID technologies operate.6

1.1. A broad concept for a complex technology

RFID is a convenient and popular concept to qualify a technology with many facets. The expression “Radio-Frequency Identification” refers to two dimensions of the technology: i) a technical aspect: radio- frequency and ii) a particular function enabled by the technology: identify objects, animals or people carrying or embedding a tag. In so doing, the term RFID can be misleading: RFID communication is not always based on radio-frequency communications – it can use electromagnetic induction – and RFID can be used in contexts in which identification is just one function among others. For example, RFID enables tracking, a function that has considerable economic and social implications. Further, some RFID tags can write data received from a reader onto their memory, as do some tags equipped with sensors to monitor environment conditions such as light, sound or temperature.

RFID would be better described as a technology that enables data collection with contactless electronic tags and wireless transmitters (readers) for identification and other purposes. Such a broad definition does not necessarily reflect the terminology used in international standards. Nonetheless, it grasps the breadth of RFID technologies.7

As described below, other factors cloud a clear definition of RFID. For example, different types of technologies may be called RFID, either because they are based on radio communications, or operate in the usual RFID frequency range, or perform similar functions. Sometimes, businesses associate the technology, products or services they implement with the “RFID” acronym for marketing or public image purposes and this can skew public perceptions.

Understanding technology capabilities or limitations helps avoid unreasonable fears or unrealistic expectations.

RFID includes a software dimension with, for example, middleware components, back-end applications, communication protocols, etc. This dimension should not be neglected for a good understanding of the technology. However, the specificity and novelty of RFID lies in its hardware component (e.g. RFID tags, readers and electromagnetic communication) which are governed by the laws of physics, like any other hardware components. This is a major difference with software technologies, such as data mining for example, which are governed by rules developed by engineers in the form of standards and as such, are mostly limited by their imagination.

The experience of information technology has been that many limitations are transient and overcome through new technological developments. For most information technologies, engineers have not yet approached theoretical limits, as exemplified by the Internet. This suggests that RFID technologies will also experience technological progress, that the current limitations of RFID technology will diminish and that some technology features that are limited and therefore acceptable today will, sooner or later, face technological breakthroughs that will remove these limitations. Tag and reader size, along with communication range are typical examples. Admittedly, technologies will continue to evolve, but the laws

6. For a more detailed understanding of how the technology works, see, for example, Finkenzeller, 2003 and Lahiri, 2005. 7. For example, systems based on ISO 14443 standards are often not called RFID systems by experts but “Contactless integrated circuit cards”, which is the ISO standard’s terminology. However, what everybody calls today an “RFID passport” is based on ISO 14443. Such distinctions are very subtle for the general public.

11 DSTI/ICCP/REG(2007)9/FINAL of physics will also continue to set theoretical limits on what the technology can and cannot perform. It is therefore important to understand where these boundaries set by laws of physics lie. Clarifying what characteristics of RFID are subject to technological evolution or not helps define adequate policy and may remove obstacles to acceptance by individuals without impeding innovation.

For scientists and other technical experts, RFID is an information technology defined in many standards. For example, the set of standards adopted by the International Organization for Standardization (ISO) is considered by some to be RFID’s main reference.8 Several other standards apply to RFID, the list of which evolves continuously.9

Some technologies are occasionally presented as alternatives to RFID. One could view these as variations of the concept, or “quasi-RFID”. They include Near Field Communication (NFC), RuBee, ZigBee, Wi-Fi, Ultra Wide Band (UWB) and innovations such as HP’s “Memory Spot”. Some of these technologies (e.g. RuBee) are not fully standardised. Others (e.g. NFC) are not identified as RFID by their promoters for reasons that may include public perception considerations. Yet others (e.g. Wi-Fi) are related to RFID from a functional perspective rather than a technical one.10

Figure 1. RFID standards, from the core to the boundaries of the concept See Annex I and II for the references of the standards

Quasi-RFID

Application Ultrasonic RuBee standards

Library Core RFID standards ZigBee ISO 18000 Supply Air interface for item chain Auto identification identifiers mobiles (ISO) ISO 10536, 14443 UWB and 15693 Contactless card Freight containers Wi-Fi Animal Tagging EPCglobal Framework

Near Field Communication

1.2. Hardware components

Tags and readers are core hardware components of an RFID system.

8 . ISO standards include the air interface standards for item identification (ISO 18000 series) and the close- coupled, proximity and vicinity contactless cards standards (ISO 10536, 14443 and 15693). Several other ISO standards are application-specific, such as animal tagging standards (ISO 11784, 11785 and 14223) or the automatic freight container identification standard (ISO 10374). ISO standards often relate to different data structures used, such as the “data model for use of radio frequency identifier (RFID) in libraries”, currently under development (ISO/NP 28560), or ISO 15963, “unique identification for RF tags” and other supply-chain related ISO standards (Oehlmann, 2006; Rees, 2004). 9 . Annex I provides a brief non-exhaustive overview of RFID standards. 10. Annex II provides an overview of the capabilities of these technologies.

12 DSTI/ICCP/REG(2007)9/FINAL

1.2.1. Tags

Tags, also called transponders, can be classified according to a number of characteristics. A distinction is usually made between passive and active tags. Memory capacity and read-write capability are also useful distinguishing factors. Tags of the future will certainly introduce new possibilities. Tags should not be confused with the objects to which they are attached or in which they are embedded.

1.2.1.1. Passive or active tags

Passive tags do not have an internal source of power and cannot send outbound signals without receiving energy from a reader. They use an incoming radio frequency signal to power up an integrated circuit and transmit a response. Their antenna must be able to both receive power from an incoming signal and transmit an outbound signal (see below). They can be as small as 0.15 mm (Figure 2, picture on the right) and as large as a postcard, depending to a large extent on the size of their antenna. Their lifetime is almost unlimited: they can be reactivated years after being manufactured. Systems operating in the Low Frequency (LF) and High Frequency (HF) bands are passive systems. Systems operating in the Ultra-High Frequency (UHF) and microwave frequency bands can be passive or active systems.

Figure 2. RFID tags Left: Item level passive tag Right: Hitachi µChip compared to grains of salt (0.15 x 0.15 x 7.5 micrometers without antenna)

Source: Left: Metro Group Future Store website, right: Hitachi. 11

Unlike passive tags, active tags have their own energy source, to power the integrated circuit, which generates an outgoing signal. Compared to passive tags, this additional energy provides active tags with several advantages and has several consequences, in particular (QED Systems, 2002): • Signal strength: active tags can receive very low power signals from the reader. Passive tags require very strong signals from the reader, up to 1 000 times the power level necessary for active tags, and the strength of the signal they return is very low. • Initiation of the communication: passive tags require a reader to first send a signal in order to communicate. Active tags can initiate the communication. For example, active tags can be programmed to send data (e.g. environmental sensor data) at specific times or when external events occur. • Tag-reader distance is shorter for passive tags than for active tags. Tags can be read from a few centimetres away, to a few meters for passive tags, and up to hundreds of meters for active tags. Reader distance depends on various factors including the antenna’s size. In order to double the reading distance of a passive tag, 16 times more power is required from the reader. By contrast, doubling the reading distance of an active tag only requires four times the power, since active tags benefit from their onboard battery.

11. The Hitachi chip is capable of transmitting a 128 bits (1038) unique ID number. It was used in the 22 million tickets issued for the 2005 World exposition with a 0.001% incidence of ticket recognition error. See www.hitachi.com/New/cnews/060206.html.

13 DSTI/ICCP/REG(2007)9/FINAL

• Environmental sensors: passive and active tags can be associated with sensors to monitor the environment. However, passive tags can only use their sensor capability when a reader is sending a signal. By contrast, active tags can continuously monitor the environment, regardless of the presence of a reader field, store sensor data and timestamp information, and send it to a reader at a specific time or when requested. • Read/Write capacity: technology is available to enable passive and active tags to store information sent by the reader. However, energy constraints typically limit data processing features for passive tags which, in addition, do not usually feature large memory space. Data processing capabilities for active tags can include the use of more complex protocols, which limits, for example, transmission errors. On the other hand, active tags’ lifetime is limited to that of their battery, which itself depends on how often the tag is requested to process and/or send information.12 Last, but not least, active tags are larger and more expensive than passive tags.13 It is anticipated that in order to realise the full potential of item- level tagging, and thus enabling RFID to become more widespread, tags must become much cheaper than the current pricing. Some experts estimate cost-effective tags will enter the market in a couple of years, and will have a major impact on the efficiency and economy of the retail industry.

1.2.1.2. Tag Memory capacity

Another distinction between different types of tags can be made according to the memory capacity of the tag’s chip. Typical memory capacity of a cheap passive identification tag is 64 bits to 1 kilobyte. More expensive tags, typically active tags, can hold more than 128 kilobytes.14 Basic item-level tags used for item-level retail tagging usually hold 96 bits (12 bytes) of data used just to contain the product’s unique identifier.15 Passport RFID tags typically store the traveller’s biometric (face image and, optionally, iris data and/or fingerprint) and passport data into a 32 kilobytes memory chip.

1.2.1.3. Tag memory capability

Read-only tags are “burned” once with information that can be accessed afterwards by readers but cannot be overwritten or erased. However, data stored in read-write tags can be read, modified and erased by readers. Some critics find this to be a mislabelled term as readers have in this case the capability to both read and write.

Read-only passive tags with low memory capacity are well-suited for item, case or pallet-level tagging of goods. When the chip only stores a unique identifier, all other information associated with the item can be stored in databases. Therefore, this solution does not require being able to write onto the chip, but instead, requires a connection to the database when information beyond an item number is needed at a given collection point in the supply chain. Different chips used in different contexts can have much more memory capacity and read/write capacity. This can be useful, for example, when no connectivity to a database is possible or desirable, when the tag is re-used, or for applications with purposes beyond simple identification (FTC, 2005, p.7). For example, to contain an up-to-date history of a patient’s body temperatures, hospital wrist bands would need to have read/write capability. Finally, some chips may be hybrid, offering some memory space for read-only operations and some memory space for both reading and writing.

12 . In some configurations, an active tag could live up to 10 years on its battery. 13 . EUR 5 to hundreds of EUR versus under EUR 0.50 for passive tags (IDTechEx, 2005). 14. 128 kilobytes may seem very small compared to today’s basic gigabytes USB key or mp3 players. However, the first version of the IBM PC launched in 1981 was shipped with only 16 kilobytes memory expandable to 256. 15. See Annex IV for a description of EPCglobal electronic product code structure.

14 DSTI/ICCP/REG(2007)9/FINAL

1.2.1.4 Auto-ID Labs/ EPCglobal classification of tags

The Auto-ID Labs and EPCglobal have developed a tag classification. This classification has been refined with time (Table 1) and is often referred to in literature on RFID.

Table 1. Auto-ID labs RFID tags class structure

Class Description 0 ID only, programmed at fabricator; read-only in the field 1 ID only, Write Once, Read Many (WORM) in field 2 Class 1, plus additional user memory and/or encryption 3 Class 2, plus battery-assist and sensors 4 Active (battery-powered) tags 5 Class 4, plus reader capability Source:. EPCGlobal

Table 2. Differences between Active and Passive RFID technologies

Passive RFID Active RFID Tag Battery No Yes Tag Power Source Energy transferred from the reader Internal to tag Availability of Tag Power Only within the field of an activated reader Continuous Required Signal Strength High (must power the tag) Low (only to carry information) from Reader to Tag Available Signal Strength Low High from Tag to Reader Communication Short or very short range (3m or less) Long range (100m or more) Range Tag lifetime Very long Limited to battery life (depends on energy saving strategy) Typical tag size Small Large Multi-Tag Collection - Collects hundreds of tags within 3 meters - Collects 1000s of tags over a 28 000 m2 from a single reader region from a single reader - Collects 20 tags moving at 8 Km/h or - Collects 20 tags moving at more than slower 160 km/h Sensor Capability Ability to read and transfer sensor values Ability to continuously monitor and record only when tag is powered by reader; no sensor input; data/time stamp for sensor date/time stamp events Data Storage Small read/write data storage (Bytes) Large read/write data storage (KBytes) with sophisticated data search and access capabilities available Typical applications Rigid business process, constrained asset Dynamic business process, unconstrained movement, basic security and sensing. asset movement, security/sensing, data Simple cargo security (one time tamper storage/logging event detection), substantial business Intermodal container, rail car process impact. Area monitoring, high speed multi-tag Individual item tagging, luggage, boxes, portals, sophisticated cargo security cartons, pallet, printed labels applications (continuous tamper detection, date/time stamp), electronic manifest Cost Low (below 0.5 EUR) High (above 5 EUR, up to hundreds) Source: adapted from QED Systems, 2002.

15 DSTI/ICCP/REG(2007)9/FINAL

1.2.1.5 Future tags

Research continues in the area of RFID tags. For example, some analysts predict large success for chipless RFID tags, which do not contain a silicon chip and can be printed directly on products and packaging at very low cost (IDTechEx, 2006b).

1.2.2. Readers

Readers, which are often called “interrogators”, are complementary to tags and can be as technically diverse as tags. In a basic scenario, a reader sends a pulse of energy “to the tag and listens for the tag’s response”. The tag detects this energy and sends back a response that contains the tag’s serial number and possibly additional information. In simple RFID systems, the reader’s energy pulse functions like an on-off switch. In more sophisticated systems, the reader’s radio-frequency signal can contain commands to the tag, instructions to read or write tag memory, and even passwords.”16 The reader can emit the signal permanently, thus always searching for tags present, or the signal can be triggered by an external event such as an operator switch, to save energy and minimise interferences.

Readers’ sizes depend on many parameters and vary from the size of a coin to that of a personal assistant or personal computer (Figure 3). Readers can embed GPS capabilities and connectivity to information systems and networks. The cost varies from USD 100 to USD 1 000 for readers of passive tags to USD 1 000 to USD 3 000 or more for readers that communicate with active tags over long distances (RFID Journal, n.d.).

Figure 3. RFID readers Handgun type reader (left), computer style reader (centre) and ultra small RFID reader (12 mm x 12 mm x 2 mm) (right)

Sources: Intermec (left), Alien Technology (center) and Innovision (right).

1.3. Electromagnetic communication

The transmission of information between tags and readers relies on the laws of electromagnetism. The laws of physics that apply to RFID are the same as those that apply to any radio system: to operate, the receiver on the tag and reader must be able to detect a signal transmitted by the respective reader or tag above the level of background environmental noise.

Designers, developers, vendors and operators of RFID systems must contend with a large number of parameters for the systems to be operational. Frequency of operation and the physics of energy and

16. Garfinkel, 2005, p.20.

16 DSTI/ICCP/REG(2007)9/FINAL information transmission are critical to RFID systems’ functioning. Other important factors include power level, antenna, interferences, reflection, absorption and mode of communication (half or full duplex). All these elements determine the range of operation of a system.

1.3.1. Frequency range

Each RFID system operates within a given frequency range. The frequency range in which a RFID system operates determines key capabilities and limitations in the system, summarised in Table 4 below. For example, the higher the frequency, the shorter the wavelength and the harder for a radio signal to go around or through obstacles to reach a receiver. Some of these limitations are interwoven with other technical characteristics introduced below.

The term “Radio-Frequency” used in RFID refers to the emission of energy within the radio frequency spectrum.17

Figure 4. Electromagnetic Spectrum Ranges, Frequencies, Wavelengths and energies

The first column (colored) Radio waves: on the left represents the EHF = Extremely high frequency frequency ranges. (Microwaves) SHF = Super high frequency Legend: (Microwaves) γ = Gamma rays UHF = Ultra high frequency HX = Hard X-rays VHF = Very high frequency SX = Soft X-Rays HF = High frequency EUV = Extreme MF = Medium frequency ultraviolet LF = Low frequency NUV = Near ultraviolet VLF = Very low frequency Visible light VF = Voice frequency NIR = Near infrared ELF = Extremely low frequency MIR = Moderate infrared FIR = Far infrared Audio frequency : 20 Hz – 20 KHz

Radio spectrum spectrum Radio

Note: EHF and SHF are sometimes considered to be not part of the radio spectrum and form their own microwave spectrum. The radio spectrum is between 9 KHz and 300 GHz. Source: Wikipedia, “Electromagnetic Spectrum”.

Governments have regulated and managed radio spectrum use in terms of operating frequency and power since the early days of radio communications.18 One objective of such regulation is to share limited radio spectrum resources. Another is to minimise the interference that may be caused by one radio system

17. The electromagnetic spectrum is the range of all possible radiations (see Figure 4). The radio frequency spectrum is a portion of the electromagnetic spectrum in which electromagnetic waves can be generated by alternating current fed to an antenna. Radio or electromagnetic waves consist of oscillating electric and magnetic fields generated by an antenna supplied with electric current. The distance between two consecutive waves is called the wavelength. The number of complete oscillation of wavelength (cycle) in a second is represented by the frequency, measured in hertz (Hz), kilohertz (KHz), megahertz (MHz) and gigahertz (GHz). For example, 132 KHz = 132 000 cycles per second. 18. The first international discussions on the regulation of radio communications took place in 1903 in Berlin. The first radio conference took place in Berlin in 1906.

17 DSTI/ICCP/REG(2007)9/FINAL to another. For example, it is important that RFID systems do not interfere with radio and television, mobile radio services (police, security and emergency services), mobile phones, as well as marine and aeronautical communications. As noted below (1.3.3), for health and safety reasons, regulation also limits power levels.

Table 3. Frequencies and regions

Low Frequency (LF) 125 – 134 kHz in Canada, Europe, Japan, and the US 30-300 kHz High Frequency (HF) 13,56 MHz in Canada, Europe, Japan, and the US 3-30 MHz Ultra-High Frequency (UHF) 433.05 – 434.79 MHz in most of Europe, US, and under consideration in Japan 300 MHz-3GHz 865 – 868 MHz in Europe 866 – 869 and 923 – 925 MHz in South Korea 902 – 928 MHz in the US 918- 926MHz in Australia 952 – 954 MHz in Japan, for passive tags starting in 2005 Microwaves 2400 – 2500 and 5.725 – 5.875 GHz in Canada, Europe, Japan and the US 2-30 GHz Source: US Department of Commerce, 2005b.

RFID systems operate at Low Frequency (LF), High Frequency (HF), Ultra High Frequency (UHF), and Microwave frequency ranges. Unlike some radio communications systems that operate at licensed frequencies (such as mobile telephony or television), RFID systems operate at specific unlicensed frequencies that are not fully harmonised internationally, in particular in the UHF and microwave ranges. Different frequencies for RFID in different regions can be challenging for those who advocate the deployment of global RFID applications, although technical solutions can cope with a certain level of divergence of frequencies (See Table 3).

1.3.2. Electromagnetic induction and radio waves

A conductor supplied with electric current radiates energy in the form of radio waves. It also produces a magnetic field around it that can be used to generat